LAN proxy: serve /hooks next to /api, so webhooks and served sockets reach the backend instead of the SPA

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WgBfkm4rCmtd1T4vHWjEPx

docker/compose.lan.yml

@@ -3,7 +3,8 @@
 # For reaching the app from a machine that cannot be given a DNS record or a
 # hosts entry. Traefik routes on the Host header and a bare IP matches no
 # router, so the frontend is published on a host port instead and proxies the
-# API on that same port: http://<host-ip>:${APP_PORT} is the whole app.
+# API and the hooks on that same port: http://<host-ip>:${APP_PORT} is the
+# whole app.
 services:
 
   frontend:

docker/nginx-api-proxy.conf

@@ -4,7 +4,10 @@
 # client asks for /api/v1/... on whatever origin served it, and never needs a
 # resolvable api.${DOMAIN} or a CORS allowance.
 
-location /api {
+# /hooks is where the flows' webhooks and served sockets live, next to the API
+# on the backend. One regex takes both, and a regex outranks `location /`,
+# which would otherwise answer /hooks with the SPA.
+location ~ ^/(api|hooks) {
     # Docker's embedded DNS, re-resolved: nginx otherwise pins the backend's
     # address at startup and 502s for good once that container is recreated.
     resolver 127.0.0.11 valid=10s ipv6=off;
@@ -18,8 +21,9 @@ location /api {
     # header naively would take it for the caller.
     proxy_set_header X-Forwarded-For $remote_addr;
     proxy_set_header X-Forwarded-Proto $scheme;
-    # The flow websocket (/api/v1/flows/ws) upgrades through here; passing the
-    # client's own Connection header covers both it and ordinary requests.
+    # The flow websocket (/api/v1/flows/ws) and a served socket upgrade through
+    # here; passing the client's own Connection header covers both and
+    # ordinary requests.
     proxy_set_header Upgrade $http_upgrade;
     proxy_set_header Connection $http_connection;
     # A live socket outlives the 60s default by design.